Updates - October 2026
The October 2026 (v20) ATT&CK release updates Techniques, Groups, Campaigns and Software for Enterprise, Mobile, and ICS.
The biggest change in ATT&CK v20 is expanded coverage of recent adversary activity and tradecraft, including new Campaigns covering attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure, along with AI-focused and AI-enabled Techniques in Enterprise and execution and command and control Techniques in ICS.
It also un-deprecates the Mobile Technique Deliver Malicious Application via Other Means, last seen in ATT&CK v11. ICS Detection Strategies now include platform and Asset context, and Mobile Detection Strategies account for the visibility limits of Android and iOS.
An accompanying blog post describes these changes as well as additional improvements across ATT&CK's various domains and platforms.
This release also includes a human-readable detailed changelog showing more specifically what changed in updated ATT&CK objects, and a machine-readable JSON changelog, whose format is described in ATT&CK's GitHub.
This version of ATT&CK contains 971 Software, 182 Groups, and 61 Campaigns.
Broken out by domain:
- Enterprise: 15 Tactics, 227 Techniques, 479 Sub-Techniques, 178 Groups, 842 Pieces of Software, 57 Campaigns, 44 Mitigations, 703 Detection Strategies, 1770 Analytics, and 106 Data Components
- Mobile: 12 Tactics, 78 Techniques, 47 Sub-Techniques, 20 Groups, 128 Pieces of Software, 3 Campaigns, 13 Mitigations, 124 Detection Strategies, 211 Analytics, and 29 Data Components
- ICS: 12 Tactics, 78 Techniques, 26 Sub-Techniques, 14 Groups, 25 Pieces of Software, 10 Campaigns, 53 Mitigations, 18 Assets, 106 Detection Strategies, 302 Analytics, and 36 Data Components
- New objects: ATT&CK objects which are only present in the new release.
- Major version changes: ATT&CK objects that have a major version change. (e.g. 1.0 → 2.0)
- Minor version changes: ATT&CK objects that have a minor version change. (e.g. 1.0 → 1.1)
- Other version changes: ATT&CK objects that have a version change of any other kind. (e.g. 1.0 → 1.2)
- Patches: ATT&CK objects that have been patched while keeping the version the same. (e.g., 1.0 → 1.0 but something like a typo, a URL, or some metadata was fixed)
- Object revocations: ATT&CK objects which are revoked by a different object.
- Object deprecations: ATT&CK objects which are deprecated and no longer in use, and not replaced.
- Object deletions: ATT&CK objects which are no longer found in the STIX data.
- Application Log Content (v3.0→v3.1)
- Command Execution (v2.1→v2.2)
- File Access (v3.0→v3.1)
- File Creation (v3.0→v3.1)
- Host Status (v2.1→v2.2)
- Logon Session Creation (v2.0→v2.1)
- Module Load (v3.0→v3.1)
- Network Connection Creation (v2.1→v2.2)
- Network Traffic Content (v2.1→v2.2)
- Network Traffic Flow (v2.1→v2.2)
- OS API Execution (v2.1→v2.2)
- Process Creation (v2.1→v2.2)
- Process Metadata (v2.1→v2.2)
- Cloud Service Enumeration (v3.0)
- Drive Creation (v2.0)
- Driver Load (v2.0)
- File Deletion (v3.0)
- File Metadata (v2.1)
- File Modification (v3.0)
- Firewall Metadata (v2.0)
- Firewall Rule Modification (v2.0)
- Firmware Modification (v2.0)
- Logon Session Metadata (v2.0)
- Network Share Access (v2.0)
- Process Access (v3.0)
- Process Termination (v2.0)
- Scheduled Job Creation (v3.0)
- Script Execution (v2.0)
- Service Creation (v2.0)
- Service Metadata (v2.0)
- User Account Authentication (v3.0)
- User Account Modification (v2.0)
- Windows Registry Key Modification (v2.0)
- Application Log Content (v3.0→v3.1)
- Application Permission (v2.1→v2.2)
- Application State (v1.0→v1.1)
- Command Execution (v2.1→v2.2)
- File Access (v3.0→v3.1)
- File Creation (v3.0→v3.1)
- Host Status (v2.1→v2.2)
- Module Load (v3.0→v3.1)
- Network Connection Creation (v2.1→v2.2)
- Network Traffic Content (v2.1→v2.2)
- Network Traffic Flow (v2.1→v2.2)
- OS API Execution (v2.1→v2.2)
- Process Creation (v2.1→v2.2)
- Process Metadata (v2.1→v2.2)
- System Settings (v2.1→v2.2)
- API Calls (v2.1)
- Cloud Service Enumeration (v3.0)
- File Deletion (v3.0)
- File Metadata (v2.1)
- File Modification (v3.0)
- Network Communication (v2.1)
- Permissions Request (v2.0)
- Process Access (v3.0)
- Process Termination (v2.0)
- Protected Configuration (v2.1)
- Scheduled Job Creation (v3.0)
- System Notifications (v2.1)
- User Account Authentication (v3.0)
- Application Log Content (v3.0→v3.1)
- Command Execution (v2.1→v2.2)
- File Access (v3.0→v3.1)
- File Creation (v3.0→v3.1)
- Logon Session Creation (v2.0→v2.1)
- Module Load (v3.0→v3.1)
- Network Connection Creation (v2.1→v2.2)
- Network Traffic Content (v2.1→v2.2)
- Network Traffic Flow (v2.1→v2.2)
- OS API Execution (v2.1→v2.2)
- Process Creation (v2.1→v2.2)
- Process Metadata (v2.1→v2.2)
- Asset Inventory (v2.0)
- Device Alarm (v2.0)
- Drive Creation (v2.0)
- File Deletion (v3.0)
- File Metadata (v2.1)
- File Modification (v3.0)
- Firmware Modification (v2.0)
- Logon Session Metadata (v2.0)
- Network Share Access (v2.0)
- Process History/Live Data (v2.1)
- Process Termination (v2.0)
- Process/Event Alarm (v2.1)
- Scheduled Job Creation (v3.0)
- Script Execution (v2.0)
- Service Creation (v2.0)
- Service Metadata (v2.0)
- Software (v2.0)
- User Account Authentication (v3.0)
- Windows Registry Key Modification (v2.0)
- Alberto Arroba García
- Bridger Hackworth (NR Labs)
- Caio Silva
- Girshel Chokhonelidze
- Jeremy Ang
- Liran Ravich, Cribl
- Menachem Goldstein
- Pooja Natarajan, NEC Corporation India
- Riku Katsuse, NEC Corporation
- Sareena Karapoola, NEC Corporation India
- Stephan H. Wenderlich, Gray-Hat IT-Security Consulting
- Vijay Lalwani